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Please amend claims as follows: 
Claims 1-128 are cancelled 

129. (Previously Presented) A method, comprising: 
collecting a plurality of transmission events provided by 

one or more nodes of a network into one or more data 
structures; and 

creating one or more characterization records for at least 
one data structure of said one or more data structures, one or 
more transmission events of said plurality of the transmission 
events being collected to said at least one data structure of 
said one or more data structures, wherein at least one of said 
one or more characterization records comprises one or more 
indicators of a location or locations of one or more data 
elements comprised in at least one of said one or more 
transmission events, to allow accessing said at least one of the 
one or more characterization records to determine said one or 
more indicators of the location or locations of said one or more 
data elements. 

130. (Previously Presented) The method of claim 12 9, wherein 
said collecting and said creating is performed by a site of a 
plurality of sites comprised in said network. 

131. (Previously Presented) The method of claim 129, wherein 
said one or more data elements are stored within said at least 
one data structure. 
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132. (Previously Presented) The method of claim 129, wherein 
said collecting comprises creating observation records of said 
plurality of the transmission events and storing said 
observation records in said one or more data structures, such 
that said at least one data structure of said one or more data 
structures comprises one or more observation records of said 
observation records created using one or more transmission 
events of said plurality of the transmission events, said one 
or more observation records being generated using one or more 
characteristics of said one or more transmission events in order 
to allow entering said one or more observation records to 
determine whether at least one of said one or more 
characteristics is present in said at least one data structure. 

133. (Previously Presented) The method of claim 132, wherein 
said one or more characteristics of said one or more 
transmission events are one or more of: a period during which a 
transmission event of said one or more transmission events is 

occurred, and an internet protocol address of a node of said one 
or more nodes transmitted said transmission event. 

134. (Previously Presented) The method of claim 132, wherein 
said at least one of said one or more characterization records 
is an index created using said one or more observation records. 

135. (Previously Presented) The method of claim 12 9, wherein 

said at least one of said one or more characterization records 
is an index comprising one or more of : a type of or an 
importance level for a transmission event of said one or more 
transmission events of said plurality of the transmission 
events, an internet protocol address of a node of said one or 
more nodes transmitted said transmission event, and an internet 
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protocol address of a node of said one or more nodes being a 
destination of said transmission event. 

136. (Previously Presented) The method of claim 129, wherein 
said at least one of said one or more characterization records 
is an index indicating how to enter said at least one of said 
one or more transmission events unabridged. 

137. (Previously Presented) The method of claim 129, wherein 
said one or more characterization records comprise a summary of 
said one or more transmission events of said plurality of the 
transmission events. 

138. (Previously Presented) The method of claim 129, wherein at 
least one of said plurality of the transmission events is a 
notification. 

13 9. (Previously Presented) The method of claim 129, wherein 

said one or more data elements comprise partial or complete data 
comprised in said at least one of the one or more transmission 
events. 

140. (Previously Presented) The method of claim 129, further 
comprising : 

storing said one or more data structures comprising 
corresponding said one or more characterization records in a 
memory, in a non-volatile memory or in a data storage. 

141. (Previously Presented) The method of claim 12 9, further 
comprising : 
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Storing said one or more data structures with corresponding 
characterization records as a file system or as a hierarchical 
file system. 

142. (Previously Presented) The method of claim 129, wherein one 
of said one or more characterization records comprise an 
aggregate summary of said at least one data structure and one or 
more of other data structures of said one or more data 
structures . 

143. (Previously Presented) The method of claim 129, wherein 
said network is configured to provide network activity data in a 
computer system comprising a plurality of nodes interconnected 
for communicating via said network. 

144. (Previously Presented) The method of claim 129, wherein all 
or selected transmission events of said plurality of the 
transmission events are notifications provided by all or 
selected nodes of said one or more nodes of said network. 

145. (Previously Presented) The method of claim 129, wherein 
said location or said locations of the one or more data elements 
are in said at least one data structure of said one or more data 
structures . 

146. (Previously Presented) The method of claim 129, further 

comprising : 

performing compression of said at least one data structure. 

147. (Previously Presented) The method of claim 129, further 
comprising: 
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148. (Previously Presented) An apparatus comprising: 

a first controller, configured to perform collecting a 
plurality of transmission events provided by one or more nodes 
of a network into one or more data structures; and 

a second controller, configured to create one or more 
characterization records for at least one data structure of said 
one or more data structures, one or more transmission events of 
said plurality of the transmission events being collected to 
said at least one data structure of said one or more data 
structures, wherein at least one of said one or more 
characterization records comprises one or more indicators of a 
location or locations of one or more data elements comprised in 
at least one of said one or more transmission events, to allow 
accessing said at least one of the one or more characterization 
records to determine said one or more indicators of the location 
or locations of said one or more data elements. 

149. (Previously Presented) The apparatus of claim 148, wherein 
said first controller is configured to perform said collecting 
by creating observation records of said plurality of the 
transmission events for storing said observation records in said 
one or more data structures, such that said at least one data 
structure of said one or more data structures comprises one or 
more observation records of said observation records created 
using one or more transmission events of said plurality of the 
transmission events, said one or more observation records being 
generated using one or more characteristics of said one or more 
transmission events in order to allow entering said one or more 
observation records to determine whether at least one of said 
one or more characteristics is present in said at least one data 
structure . 
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150. (Previously Presented) The apparatus of claim 149, further 
comprising : 

a memory, configured to store said one or more data 
structures and to store, for said at least one of said one or 
more data structures, said one or more observation records and 
said one or more characterization records. 

151. (Previously Presented) The apparatus of claim 149, wherein 
said one or more characteristics of said one or more 
transmission events are one or more of: a period during which a 

transmission event of said one or more transmission events is 
occurred, an internet protocol address of a node of said one or 
more nodes transmitted said transmission event . 

152. (Previously Presented) The apparatus of claim 149, wherein 
said at least one of said one or more characterization records 
is an index created using said one or more observation records. 

153. (Previously Presented) The apparatus of claim 148, further 
comprising : 

a memory, configured to store said one or more data 
structures comprising corresponding said one or more 
characterization records. 

154. (Previously Presented) The apparatus of claim 151, wherein 

said memory is a non-volatile memory or a data storage. 

155. (Previously Presented) The apparatus of claim 151, wherein 
said one or more data structures with corresponding 
characterization records are stored as a file system or as a 
hierarchical file system. 
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156. (Previously Presented) The apparatus of claim 148, wherein 
said location or said locations of the one or more data elements 
are in said at least one data structure of said one or more data 
structures . 

157. (Previously Presented) The apparatus of claim 148, wherein 
said one or more data elements are stored within said at least 
one data structure . 

158 . (Currently Amended) The apparatus of claim 148, 
wherein said at least one of said one or more characterization 
records is an index comprising one or more of: a type of or an 
importance level for a transmission event of said one or more 
transmission events of said plurality of the transmission 
events, an internet protocol address of a node of said one or 
more nodes transmitted said transmission event, and an internet 
protocol address of a node of said one or more nodes being a 
destination of said transmission event. 

15 8 159 . (Currently Amended) The apparatus of claim 14 8, 
wherein said at least one of said one or more characterization 
records is an index indicating how to enter said at least one of 
said one or more transmission events unabridged. 

159 160 . (Currently Amended) The apparatus of claim 148, 

wherein said one or more characterization records comprise a 

summary of said one or more transmission events of said 
plurality of the transmission events. 
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161 ■ (Currently Amended) The apparatus of claim 148, 
wherein at least one of said plurality of the transmission 
events is a notification. 

i€i 162 ■ (Currently Amended) The apparatus of claim 148, 
wherein said one or more data elements comprise partial or 
complete data comprised in said at least one of the one or more 
transmission events. 

■3rSa- 163 ■ (Currently Amended) The apparatus of claim 148, 
wherein one of said one or more characterization records 

comprise an aggregate summary of said at least one data 
structure and one or more of other data structures of said one 
or more data structures. 

ir€3- 164 . (Currently Amended) The apparatus of claim 148, 
wherein all or selected transmission events of said plurality of 
the transmission events are notifications provided by all or 
selected nodes of said one or more nodes of said network. 

■3r64- 165 ■ (Currently Amended) The apparatus of claim 148, 
wherein said location or said locations of the one or more data 
elements are in said at least one data structure of said one or 
more data structures . 

4rfr4r 166 ■ (Currently Amended) A computer software product, 
comprising a computer-usable medium having computer readable 
instructions stored thereon for execution by a processor to 
perform a method comprising: 

collecting a plurality of transmission events provided by 
one or more nodes of a network into one or more data 
structures; and 
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creating one or more characterization records for at least 
one data structure of said one or more data structures, one or 
more transmission events of said plurality of the transmission 
events being collected to said at least one data structure of 
said one or more data structures, wherein at least one of said 
one or more characterization records comprises one or more 
indicators of a location or locations of one or more data 
elements comprised in at least one of said one or more 
transmission events, to allow accessing said at least one of the 
one or more characterization records to determine said one or 
more indicators of the location or locations of said one or more 
data elements. 

i-6-& 167 . (Currently Amended) The computer software product of 
claim -3r€r4- 166 , wherein said one or more data elements are stored 
within said at least one data structure. 

168 . (Currently Amended) The computer software product of 

claim ir€r4r 166 , wherein said collecting comprises creating 
observation records of said plurality of the transmission events 
and storing said observation records in said one or more data 
structures, such that said at least one data structure of said 
one or more data structures comprises one or more observation 
records of said observation records created using one or more 
transmission events of said plurality of the transmission 
events, said one or more observation records being generated 
using one or more characteristics of said one or more 
transmission events in order to allow entering said one or more 
observation records to determine whether at least one of said 
one or more characteristics is present in said at least one data 
structure . 
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169 . (Currently Amended) The computer software product of 
claim 168 , wherein said one or more characteristics of said 

one or more transmission events are one or more of: a period 
during which a transmission event of said one or more 
transmission events is occurred, and an internet protocol 
address of a node of said one or more nodes transmitted said 
transmission event. 

irS& 170 . (Currently Amended) The computer software product of 
claim i:r&& 168 , wherein said at least one of said one or more 
characterization records is an index created using said one or 
more observation records. 

i€r& 111 . (Currently Amended) The computer software product of 
claim ir&A: 166 , wherein said at least one of said one or more 
characterization records is an index comprising one or more of: 
a type of or an importance level for a transmission event of 
said one or more transmission events of said plurality of the 
transmission events, an internet protocol address of a node of 
said one or more nodes transmitted said transmission event, and 
an internet protocol address of a node of said one or more nodes 
being a destination of said transmission event. 

172 . (Currently Amended) The computer software product of 
claim i€4- 166 , wherein said at least one of said one or more 
characterization records is an index indicating how to enter 
said at least one of said one or more transmission events 
unabridged . 

i^4lr 173 . (Currently Amended) The computer software product of 
claim i€4- 166 , wherein said one or more characterization records 
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comprise a summary of said one or more transmission events of 
said plurality of the transmission events. 

■3r?*. 174 . (Currently Amended) The computer software product of 
claim -tS^r 166 , wherein at least one of said plurality of the 
transmission events is a notification. 

■3r73- 175 . (Currently Amended) The computer software product of 
claim -3764- 166 , wherein said one or more data elements comprise 
partial or complete data comprised in said at least one of the 
one or more transmission events. 

17 4 176 . (Currently Amended) The computer software product of 
claim ir&4- 166 , wherein said method further comprises : 

storing said one or more data structures comprising 
corresponding said one or more characterization records in a 
memory, in a non-volatile memory or in a data storage. 

•3r7S 177 ■ (Currently Amended) The computer software product of 
claim 1-64- 166 , wherein said method further comprises: 

storing said one or more data structures with corresponding 
characterization records as a file system or as a hierarchical 
file system. 

•IrT-S- 178 . (Currently Amended) The computer software product of 
claim ^r&4r 166 , wherein one of said one or more characterization 
records comprise an aggregate summary of said at least one data 
structure and one or more of other data structures of said one 
or more data structures. 

179 . (Currently Amended) The computer software product of 
claim i€4r 166 , wherein all or selected transmission events of 
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said plurality of the transmission events are notifications 
provided by all or selected nodes of said one or more nodes of 
said network. 

176 180 ■ (Currently Amended) The computer software product of 
claim ^G4r 166 , wherein said location or said locations of the 
one or more data elements are in said at least one data 
structure of said one or more data structures. 

181 . (Currently Amended) The computer software product of 
claim irSA 166 , wherein said method further comprises: 

performing compression of said at least one data structure. 

182 . (Currently Amended) The computer software product of 
claim ^€4- 166 , wherein said method further comprises: 

creating a digital signature of said at least one data 
structure . 
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